i am installing the new Splunk App for VMware.
i have completed the esxi logs
and OVA to get performance data
but i am facing an issue in getting the vcenter data from linux vcenter appliance 6.0
as per the documentation, it was mentioned to install the universal forwarder in vcenter appliance but client is not agreeing to the same
they are able to send the data through syslog server but issue is every thing is coming as file only. but Splunk_TA_vcenter component is expecting three different inputs directory and props based on the directory and type of file , it is dividing the data in to different sourcetype
but with out any knowledge of data how can i differentiate as expected by TA .
kindly help ASAP